# Private networking

> Deployments in the same Ownkube environment talk to each other over a private network: apps call each other by name, and databases and caches are reachable only from inside.

Every [environment](/docs/deployments/environments) has its own private network. Deployments inside it reach each other directly, without leaving the region and without going through the public edge. Nothing outside the environment, including your other environments, can reach that network.

## Apps calling apps

A web app or worker is reachable from the rest of its environment by its deployment name. The deployment's **Overview** tab shows the exact address next to the public one:

```
http://<deployment-name>
```

For example, a worker that needs the `api` app calls `http://api`. Traffic is plain HTTP inside the network; TLS is only needed at the public edge. A worker with **Public hostname** off is reachable this way and nowhere else.

If the target is [asleep](/docs/deployments/sleep), the call is held while it wakes, so a request to a public app can wake the private services behind it.

## Databases and caches

A [Postgres](/docs/data/postgres) or [Valkey](/docs/data/valkey) deployment has a private address only. [Linking](/docs/deployments/variables#variables-ownkube-sets-for-you) it to an app writes that address into the app's `DATABASE_URL` or `REDIS_URL`. The Overview tab of the datastore shows the same address under **Private**, and says why to prefer it: it stays on the private network, connects faster and its traffic is free.

To reach a datastore from outside the environment, turn on **Public access** on it, or open a tunnel from your laptop with [`okctl connect`](/docs/deployments/shell#connect-to-a-database-or-cache).

## Environments are walls

An app in `staging` cannot reach the database in `production`, even inside the same project. That is deliberate: it is what makes an environment safe to experiment in. If two services must talk, put them in the same environment. Shared configuration across environments goes through [shared variables](/docs/deployments/variables#shared-variables-on-an-environment), not shared network.

## What leaves the network

| Traffic | Path | Billed |
| --- | --- | --- |
| App to app, app to datastore, same environment | Private network | Free |
| Public hostname to the internet | Region edge | Per GB at the [region rate](/docs/deployments/regions) |
| App to a third-party API on the internet | Region egress | Per GB at the region rate |
| Inbound from the internet | Region edge | Free |

## Own cloud

On a cluster in your AWS account the same rules apply inside the cluster, and the private address takes the longer form the Overview tab shows, `http://<deployment-name>.<environment>.svc.cluster.local`. See [Clusters](/docs/own-cloud/clusters).

- [Public hostnames and TLS](/docs/networking/public-hostnames)
- [Environments](/docs/deployments/environments)
- [Variables](/docs/deployments/variables)

---

**Don't see a feature you need?** Email [support@ownkube.io](mailto:support@ownkube.io?subject=Feature%20request). Ownkube is shaped by the teams using it and we ship what our users ask for.

## Search

This site has a search endpoint: https://context7.com/api/v2/ask?siteKey=ask_c64dfe8ffaa8d3ad19576838&query=<URL-encoded question>. It returns documentation that answers the question, with a source link for each part. No API key is needed. If nothing matches, it says so.